Privacy policy

INTRODUCTION

Our company respects your privacy and is committed to protecting your personal data. The information you give us is processed in accordance with our privacy policy which is compliant with the EU General Data Protection Regulation (Regulation (EU) 2016/679) known as GDPR, other EU legislation and pertinent laws of the Republic of Cyprus.

1. IMPORTANT INFORMATION AND WHO WE ARE

PURPOSE OF THIS PRIVACY NOTICE

This privacy notice aims to give you information on how we collect and processes your personal data through the website or the call centre for the purpose of issuing your air ticket, offering ancillaries, to sign up to our newsletter, to participate in our online competitions or to apply for a job posting.

We have appointed a data protection officer (DPO) who is responsible for overseeing our compliance with data protection applicable legislation.

Should you have any questions or concerns please contact the DPO. We are ready to address your concerns and we will gladly provide any explanations on issues such as, the use of your personal data, access to your data, or withdrawal of consent you have previously given us to receive any of our products.

Our privacy policy is currently being updated in order to align it to the requirements set out in GDPR which becomes applicable on May 25, 2018.

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.

THIRD-PARTY LINKS

Our website may include links to third-party websites and applications.Our main partners are: Rentalcars.com,Booking.com,parkcloud.com. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy notice of every website you visit.

2. THE DATA WE COLLECT ABOUT YOU

Personal data, is any information that relates to an identified or identifiable living individual.

The information we collect varies depending on whether you would like to purchase an air ticket, subscribe to our newsletter, participate in any online competition we organize or simply browse our website having accepted our cookies policy.

We do not collect or process any sensitive personal data except in the case of passengers requiring personalized assistance due to their medical condition or disability or if a passenger will be assessed by our aviation medical examiner prior to or during a flight. In such cases the information is limited to what is needed to provide assistance during air transport and at the airports of departure and destination.

Data is also collected following an online application to the Human Resources Department.

3. HOW IS YOUR PERSONAL DATA COLLECTED?

We use different methods to collect data from and about you including through:

Direct interactions.You give us data concerning your identity, contact details and payment method when you purchase an air ticket and ancillaries. Tickets and ancillaries can be bought online through our website, or by contacting the Call Centre. If you require personalized assistance prior to or during the flight you will give us any special category of personal data by filling out our relevant forms.

You give us your email address when you subscribe to our newsletter.

You give us your preferences when you opt in to receive customized marketing material to have a better website experience.

You give us personal data regarding your professional qualifications when you submit an online application for a vacancy.

Through the use of cookies.If you agree, we collect data about your preferences by using cookies. Please see ourcookie policyfor further details.

4. HOW WE USE YOUR PERSONAL DATA

We will use your personal data in the following circumstances:

To carry out our obligations under the air carriage contract we enter into with you and to offer you any ancillaries you have purchased.

To inform you of any flight delays or cancellations.

To send you our newsletter if you are subscriber.

To send you marketing material if you have indicated you wish to receive it.

To assess your suitability as a potential job candidate.

Where we need to comply with a legal or regulatory obligation.

You have the right to withdraw consent to receiving marketing material and to unsubscribe from our newsletter at any time. This option is available at every communication we have with you.

5. DISCLOSURE AND INTERNATIONAL TRANSFER OF YOUR PERSONAL DATA

We may forward your booking data to our associate companies involved in the provision of products and services to our passengers. Such disclosure aims at facilitating the completion of the air carriage contract with you as our passenger or to offer you any additional services such as car rentals or accommodation booking.

All our associates are bound by the contractual obligation to comply with the standards set by the GDPR and other EU and Cyprus legislation on data protection and e-privacy.

Some of our associates are located outside the European Economic Area so their processing of your personal data will involve a transfer of data outside the EEA, mainly to the USA, Canada and the Russian Federation. All such transfers are carried out in compliance with the standards set by the GDPR and in accordance with the instructions we receive from the Commissioner for Personal Data Protection in Cyprus.

Some of our associates are located in countries that are covered by an adequacy decision issued by the European Commission. For other providers we use specific contracts approved by the European Commission and by the Cyprus Commissioner for Personal Data Protection. The contractual obligations created ensure that the same level of protection applies as for transfers within the EU.

For the purpose of processing payment of your ticket and ancillaries we use the payment services of a credit institution operating out of the EEA. The bank holds a certification awarded by the PCI Security

In order to facilitate your travel arrangements and your access to the country of destination or transit we may also share your data with the border control authorities of the country of your destination including any stop — over in your itinerary. In accordance with international standards and laws applicable to aviation, Cyprus Airways has the obligation to comply with the requirements of border control authorities and to respond to the requests of the Passenger Information Units which are being set up as a result of the transposition of EU Directive 2016/681.

Standards Council for meeting the PCI Data Security Standard (PCI DSS) version 3.2. The technical details of the Standard can be found here.

Pleasecontact usif you want further information on the specific mechanism used by us when transferring your personal data out of the EEA.

6. INTERLINE AGREEMENTS

Your personal data collected for the purpose of issuance of your air ticket and performance of the air carriage contract may be transferred to our partner airlines if the ticket is issued under an interline agreement.

Interlining allows us to offer you services on additional air routes covered by our partners. The Operating Carrier will process your data for the purpose of transferring you to your destination following the standards set out in GDPR. Our interline partners at the moment are:

Siberian Airlines or “S7” : www.s7.ru

Qatar Airways : www.qatarairways.com

Blue Air : www.blueairweb.com

Bulgaria Air: https://www.air.bg/bg

7. DATA SECURITY

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who are involved in our performance of the air carriage contract or in the provision of other services to you. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.

8. YOUR RIGHT OF ACCESS

Under certain circumstances, you have the right to request a copy of any personal data that you have provided us and you may make corrections to such data.

If you have submitted an application online for a vacancy announced on our website or if you have filled out a general application, your data will be used only for the purpose of recruitment.

General applications are retained for a limited period following profile activation. If you wish to be considered for future vacancies and you are not sure that your application is still in the Human Resources database or if you have any other requests you may contact the Human Resources department athr@cyprusairways.com

Access to your personal information is limited to the Human Resources department of the Company and those authorized officers, employees and agents of our company who are responsible for the processing and assessment of your application.